Hermitic Builds

Every build carries a number: the count of entropy sources standing between its source and a bit-for-bit reproducible binary. The goal is to drive it to zero.


Domain

Build provenance

Stage

Research

Started

2025

Products

CHE toolkit


CHE → 0

Entropy sources between source and binary

HASH1–5

A complete provenance record

Bitwise

The reproducibility target

The problem

Nobody can rebuild the binary they shipped.

Corporate governance keeps the source, sometimes the build container, almost never the resolved toolchain. When a binary has to be reproduced years later for an audit, a liability claim or a forensic reconstruction, the exact inputs are already gone.

Non-determinism does the rest quietly — build-time temp files, urandom, clock-based compiler optimizations, uninitialized memory, host config — and almost no one is measuring how much of it a given build contains.


The approach

Make reproducibility a number.

01

Seal the build

The whole build runs in a container: source bind-mounted read-only, results read-write, and every tool and system header baked immutably into the image. An strace pass records every file, network, time and /proc access that leaks in.


02

Classify every input

Files accessed outside the source tree are traced to their originating packages; the known set is folded back in for reproducibility, and the unknown set is exactly the entropy left to eliminate.


03

The CHE metric

Charlton Hermitic Entropy counts the entropy sources that prevent a reproducible build, from source-and-toolchain to container to binary. It turns reproducibility from an aspiration into a number engineering can drive to zero — and a KPI leadership can be held to.


Provenance

Five hashes, one chain.

Each build emits a chain of hashes: the parent image, the built container, the resolved package metadata, the source commit and the product binary. Their union is a complete provenance record, and a pair like the container and its source uniquely identifies a binary.

The inputs are archived in immutable, owned repositories for the support window plus the liability statute — often decades — and can be logged to an immutable ledger, so any released product can be reconstructed and verified long after the machine that built it is gone.


Where it stands

Tooling, and honest measurement.

MilestoneStatusEvidence
Hermetic build + leak detectionRunningstrace-based tooling
CHE metric + package classificationIn progressOn FOSS examples
Bitwise-stable rebuildsIn progressReproducibility study
Provenance archival + ledgerNext

Figures on this page are targets and internal measurements at proof-of-concept stage. We share the methodology with anyone who wants to run it.


What's next

Publish the number.

Next is publishing the toolkit and sample CHE calculations for large open-source projects — Android, Linux, PostgreSQL — and pushing representative builds toward bitwise-stable rebuilds.

Hermitic Builds spins out of Research ByIQ once CHE is something teams can compute, report and drive down inside their own pipelines.